TMA-ALIBABA-1.3
Ensure MFA is enabled for the "root" account
설명
With MFA enabled, anytime the "root" account logs on to Alibaba Cloud, it will be prompted for username and password followed by an authentication code from the virtual MFA device. It is recommended that MFA be enabled for the "root" user. It is important to prevent "root" account from being compromised. Enabling MFA requires the "root" account holder to provide additional information on top of username and password. Reported as a manual review item: the benchmark audit needs console review or organisational judgement.
점검 방법
감사 방식: 수동 검토
이 권장 사항은 자동으로 점검할 수 없습니다. --include-manual 옵션을 전달하면 스캔 결과에 이 지침과 함께 표시됩니다.
Perform the following to determine if an MFA device is enabled for the "root" account: Using the management console: 1. Logon to RAM console by using your Alibaba Cloud account (root account). 2. In the left-side navigation pane, click Overview. 3. In the Security Check section, make sure that Enable MFA for Root Account is marked as Finished.
조치 방법
조치 방식: 가이드 또는 인프라 패치
Perform the following to enable MFA for "root" account Using the management console: 1. Logon to RAM console by using your Alibaba Cloud account (root account). 2. Move the pointer over the account icon in the upper-right corner and click Security Settings. 3. In the Account Protection section, Click Edit. 4. On the displayed page, select a scenario and select TOTP. 5. Click Submit. 6. On the displayed page, click Verify now. 7. Enter the verification code and click Submit. 8. Download and install a mobile application that supports TOTP MFA, such as Google Authenticator, on your mobile phone. Note: If you already installed Google Authenticator, click Next.
속성
- 운영 체제
- 모두
- 태그
- alibabaram
- 참고 자료
- CIS Alibaba Cloud Foundation Benchmark v2.0.1 - 1.3 Ensure MFA is enabled for the "root" account